Antivirus, antispyware, and other anti-malware applications seek to protect client computers by identifying harmful applications or other executable code and removing or at least neutralizing the harmful code. One of the techniques used by anti-malware applications (e.g., Microsoft Windows Defender, Microsoft Forefront Client Security, Microsoft OneCare, Microsoft Forefront Server for Exchange Server, and so forth) is a signature-based approach to detect viruses, worms, and spyware. A threat to the anti-malware product is a group of objects detected on the target system related to an instance of malware. Each object in the group is a resource, such as a file, registry key, or other system object.
Malware information and information related to detecting malware is often stored in one or more configuration databases, such as the Microsoft Windows Registry. The malware product may use the configuration information to locate malware by determining where a user's documents folder is located, where a user's applications download files, and so forth. Malware information may also be stored along with configuration information, such as in registry keys that specify applications to run when a user logs on. Thus, scanning one or multiple system or user configuration databases is often a preliminary step performed by anti-malware applications to detect changes and harmful modifications, as well as to query configuration information used to scan other parts of the system. As an example, malware may be located at the logical path C:\spy.exe on an inactive system. However, from the running system, the logical path to access this file may be a D:\spy.exe due to the operating system's internal partition mapping technique. To properly find the malware, an antimalware program loads the operating system's configuration database to identify partition mappings
The system configuration database is often stored in several physical files separately on a computer storage system or networked server. Not all registry files are loaded into the system when the system is running. For example, in a multiuser system, the operating system may not load configuration files associated with a logged off user. When a computer system is offline, registry files on the system may be in an unloaded state. To access a logged-off user's or inactive system's configuration files, an anti-malware product may load the configuration files from the computer storage system. As an example, malware may be stored in the registry key “HKU\S-1-5-21-2127521184-1604012920-1887927527-2468930 \Software\Microsoft\Windows\Run” on a computer system. When the infected user is not logged on, this registry key is not loaded into memory and thus the antimalware program cannot scan the registry key without loading the key into memory (and thereby consuming additional system resources).
This practice has several drawbacks. First, it is expensive in terms of memory usage, processor time, and input/output (I/O) operations to load a large system configuration file. In addition, the system configuration files are a public resource shared by multiple application and system activities, and the system may expect exclusive access to the configuration files. Loading a logged-off user's configuration file could potentially conflict with these other activities (e.g., a profile service attempting to log a user on to the system). Such conflicts can potentially result in an unstable system that prevents the user from logging on to the system. Even when loaded to memory, a user's configuration files may be difficult to scan because malware often uses operating system functions to hide registry keys that contain malware data. In addition, configuration files loaded in memory may be larger than their disk-based counterparts due to pointers and other data members set up in memory for faster memory access.